Tracking state syslog "%TRACKING-5-STATE" not generated IOS 12.4 (10b)

[jtitus]

I've been trying to set up on EEM applet or TCL script based off of a track state flipping Up/Down to perform a series of actions. I have EEM version 2.1 on IOS 12.4(10b). Since event tracking isn't supported, I wanted to use event syslog or a TCL script with syslog pattern. 

I've been trying to generate the "%TRACKING-5-STATE" syslog message from a router running IOS 12.4(10b) without any luck. I've also tried this on 12.3(9a). 

I have had luck generating it on IOS versions 12.4(15)T3 and 15.1(3)T, but i'm forced to use 12.4(10b) for this particular problem.

Relevant configuration:

track 1 ip route 10.0.0.1 255.255.255.255 reachability
 delay down 5 up 10     
logging buffered 120000 debugging
logging source-interface Loopback0
logging 10.0.0.15
logging 10.0.0.16

I've tried this with/without delay configured.

Then I've simply been issuing the following command to flip the track state Up/Down. 

(no) ip route 10.0.0.1 255.255.255.255 Null0

I've turned on debug track and see 

Feb 21 20:55:01.653: Track: 1 Down change delayed for 5 secs
Feb 21 20:55:06.653: Track: 1 Down change delay expired
Feb 21 20:55:06.653: Track: 1 Change #31 IP route 10.0.0.1/32, static->no route, reachability Up->Down

However, no syslog messages have been generated on the local router or forwarded to the syslog server. 

I'm trying to figure if anyone else has had this problem or has found a way around other than upgrading the IOS version. I haven't found any bug reports, or any posts/discussions that show a solution or explanation. 

[Julio E. Moisa]

Hi

Try enabling:

logging traps 5

[jtitus]

Thank you for your response. I didn't have a "no logging trap" so I believe this was already enabled at default priority informational.

Nonetheless I tried this and still does not produce a syslog message or trap.

From my understanding; using the "snmp-server enable traps syslog"command would produce a trap if a syslog message enters the routing history table. I've tried enabling "routing history debugging" as well, but if no syslog message is produced, it can't enter the history table, so no traps are produced. 

My goal is to produce a syslog message so I can write an EEM script that acts upon seeing that syslog message. 

[jtitus]

I found a possible solution if anyone else has this problem. One possibility is to enable

debug track

and write an EEM applet that will pick up on the debug messages.

event manager applet TESTAPP_TRACKDEBUG
 event syslog priority debugging pattern "Track: 1 Change"
 action 1.0 syslog msg "Insert Syslog Message here if desired"
 action 2.0 .....................................

It just means that if you have delaying configured you will see 3 messages anytime there is a change. Delay for X seconds, delay expired, track state up/down. And if there are multiple tracks then there will be debug messages for all of those as well in the logging buffer.

By default the EEM applets' syslog messages will be from "%HA_EM-6-LOG". The TCL script can be triggered from  that syslog message generated in action 1.0 or I suppose it could be called from an action cli "event manager run TCL_SCRIPT.tcl", so long as the TCL script has a none event trigger so that it can be called manually.

This isn't an ideal solution so if anyone finds another solution or explanation for this behavior, please do share.